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The class QMA(fc), introduced by Kobayashi et al., consists of all languages that can be 
verified using k unentangled quantum proofs. Many of the simplest questions about this class 
have remained embarrassingly open: for example, can we give any evidence that k quantum 
proofs are more powerful than one? Does QMA(fc) == QMA(2) for fc > 2? Can QMA(fc) 
protocols be amplified to exponentially small error? 

In this paper, we make progress on all of the above questions. 

• We give a protocol by which a verifier can be convinced that a 3Sat formula of size m is 
satisfiable, with constant soundness, given O {y/m) unentangled quantum witnesses with 
O (logTTi) qubits each. Our protocol relies on the existence of very short PCPs. 

• We show that assuming a weak version of the Additivity Conjecture from quantum infor- 
mation theory, any QMA (2) protocol can be amplified to exponentially small error, and 
QMA (fc) = QMA (2) for aU fc > 2. 

• We prove the nonexistence of "perfect disentanglers" for simulating multiple Merlins with 
one. 

1 Introduction 

Quantum entanglement is often described as a complicated, hard-to-understand resource. But 
ironically, many questions in quantum computing are easiest to answer assuming unlimited entan- 
glement, and become much more difficult if entanglement is not allowed! One way to understand 
this is that Hilbert space — the space of all quantum states — has extremely useful linear-algebraic 
properties, and when we restrict to the set of separable states we lose many of those properties. 
So for example, finding a quantum state that maximizes the probability of a given measurement 
outcome is just a principal eigenvector problem, but finding a separable state that does the same 
is NP-hard 0. 

These observations naturally give rise to a general question at the intersection of computational 
complexity and entanglement theory. Namely: supposing we had k quantum proofs, could we use 
the promise that the proofs were unentangled to verify mathematical statements beyond what we 
could verify otherwise? 



*To whom correspondence should be addressed. Email: aaronson@csail.mit.edu. 



1.1 Background and Related Work 

The class QM A, or Quantum Merlin- Arthur, consists of all languages that admit a proof protocol in 
which Merlin sends Arthur a polynomial-size quantum state {ip), and then Arthur decides whether 
to accept or reject in quantum polynomial time. This class was introduced by Knill [T7], Kitaev 
[15], and Watrous [29] as a quantum analogue of NP. By now we know a reasonable amount about 
QMA: for example, it allows amplification of success probabilities, is contained in PP, and has 
natural complete promise problems. (See Aharonov and Naveh [2] for a survey.) 

In 2003, Kobayashi, Matsumoto, and Yamakami [19] defined a generalization of QMA called 
QMA (k). Here there are k Merlins, who send Arthur k quantum proofs IV'i) , • • • , \ipk) respectively 
that are guaranteed to be unentangled with each other. (Thus QMA(l) = QMA.) Notice that in 
the classical case, this generalization is completely uninteresting: we have MA (k) = MA for all k, 
since we can always simulate k Merlins by a single Merlin who sends Arthur a concatenation of the 
k proofs. In the quantum case, however, a single Merlin could cheat by entangling the k proofs, 
and we know of no general way to detect such entanglement. 

When we try to understand QMA (A;), we encounter at least three basic questions. First, do 
multiple quantum proofs ever actually help? That is, can we find some sort of evidence that 
QMA (A;) 7^ QMA(l) for some k? Second, can QMA (A) protocols be amplified to exponentially 
small error? Third, are two Merlins the most we ever need? That is, does QMA(/c) = QMA (2) 
for ah A > 2'fl 

We know of three previous results that are relevant to the above questions. 

First, in their original paper on QMA(fc), Kobayashi et al. [1^ proved that a positive answer 
to the second question implies a positive answer to the third. That is, if QMA {k) protocols can 
be amplified, then QMA {k) = QMA (2) for ah k>2. 

Second, Liu, Christandl, and Verstraete [21] gave a natural problem from quantum chemistry, 
called pure state N -representability, which is in QMA (2) but is not known to be in QMA. 

Third, Blier and Tapp [7] recently (and independently of us) gave an interesting QMA (2) 
protocol for an NP-complete problem, namely 3- Coloring. In this protocol, Arthur verifies that 
an n- vertex graph G is 3-colorable, using two unentangled witnesses with only O (log n) qubits 
each. There is a crucial caveat, though: if G is not 3-colorable, then Arthur can only detect this 
with probability Jl (l/n^) rather than constant probabilityo 

1.2 Our Results 

In this paper, we present new results about all three problems listed previously. Our main results 
are as follows: 

Proving 3Sat With O (\/m) Qubits. In Section O we give a protocol by which Arthur 
can verify that a 3Sat instance of size m has a satisfying assignment, using O (\/mpolylogm) 
unentangled witnesses with O (log m) qubits each. Of course, this is a larger number of qubits 
than in the protocol of Blier and Tapp [7], but the point is that Arthur can detect cheating with 
constant probability. Our protocol relies on the POP Theorem, and in particular, on the existence 
of PCP's of size O (mpolylogm), which was recently shown by Dinur [llj . 



^The second and third questions are motivated, in part, by an analogy to classical multi-prover interactive proof 
systems — where the Parallel Repetition Theorem of Raz [26] and the MIP (fc) = MIP (2) theorem of Ben-Or et al. [3] 
turned out to be crucial for understanding the class MIP. 

^Indeed, if the soundness gap were constant rather than 1/ poly (n), then Blier and Tapp's protocol could presum- 
ably be "scaled up by an exponential" to show QMA (2) = NEXP! 



Weak Additivity Implies Amplification. In Section [H we reduce several open problems 
about QMA (k) to weak versions of the Additivity Conjecture in quantum information theory. (In 
an earlier version of this paper, we pointed out that the weak versions would suffice, but based 
our results on the original Additivity Conjecture, which was widely believed at the time. Then, 
as the paper was undergoing final revisions, Hastings [13] announced a spectacular disproof of 
the Additivity Conjecture.) In particular, we show that weak versions of Additivity Conjecture 
imply that any QMA (2) protocol can be amplified to exponentially small error, that the "QMA (k) 
hierarchy" collapses to QMA (2), and that forcing the Merlins' witnesses to be identical does not 
change the power of QMA (2). 

Nonexistence of Perfect Disentanglers. In Section [H we rule out one possible approach to 
showing QMA (2) = QMA, by proving an extremely simple result that nevertheless seems new and 
might be of interest. Namely, given finite-dimensional Hilbert spaces TC,IC, there is no quantum 
operation mapping the set of all states in 7i to the set of all separable states in /C /C. 

Note: In an earlier version of this paper, we claimed to give evidence that QMA (2) C PSPACE, 
by showing that this would follow from what we called the "Strong Amplification Conjecture" : that 
it is possible to amplify any QMA (2) protocol, in such a way that one of the Merlin's Hilbert space 
dimensions remains small compared to the inverse of the error bound. (The trivial upper bound 
is QMA (2) C NEXP, which follows by just guessing exponential-size classical descriptions of the 
k quantum proofs.) However, Fernando Brandao subsequently pointed out to us that the Strong 
Amplification Conjecture would actually imply QMA (2) = QMAJj Thus, the Strong Amplification 
Conjecture now seems very unlikely be true, and while our result was correct, it has been both 
superseded and effectively nullified in its import. We have not included it in the current version. 

In the remainder of this introduction, we give some intuition behind each of these results. 

1.3 Proving 3SAT With O (y/m) Qubits 

Let iphe a 3Sat instance with n variables. Then how long a proof does Merlin need to send Arthur, 
to convince him that f is satisfiable? (As usual. Merlin is an omniscient prover and Arthur is a 
skeptical BPP verifier.) 

Intuitively, it seems the answer should be about n bits. Certainly, if sublinear-size proofs of 
satisfiability existed, then 3Sat would be in solvable in 2°^'^' time, since Arthur could just loop 
over all possible proofs until he found one that worked. Even in the quantum case, one can make 



■^Here is a sketch of the argument, which we are grateful to Brandao for allowing us to include. If we have two 
Merlins A and B, and the witness of A has only s (n) qubits, then any bipartite pure state \^ab} can be decomposed 
in Schmidt form as 

2=(") 

I'tpAs) = "^ >^i \(f>^)A \V^)b ' 
1=1 

where the |0i)^ \^pi}g's are all orthogonal to each other, regardless of the size of B. Now, by assumption, every 
unentangled state of the form \<j)i)A I'fii) b causes Arthur's amplified protocol to accept with only a tiny probability — 
say, less than 2~^'"'. But this means that Arthur's acceptance probability on \iPab) can be at most 



2-s{n) Y^ |^.| ^ 2- = (")/2 



by Cauchy-Schwarz. Therefore, the amplified QMA (2) protocol is still sound even if the Merlins entangle their 
witnesses, and hence the language being verified is in QMA. 



a similar statement: if quantum proofs of satisfiability with o (n) qubits existed, then 3Sat would 
have a 2°^"^-time quantum algorithm. 

On the other hand, suppose Arthur is given several quantum proofs, which are guaranteed to 
be unentangled with each other. Then the previous argument no longer seems to work. And this 
at least raises the possibility that 3Sat might have sublinear proofs in this setting. 

We will show that this possibility is realized: 

Theorem 1. Let ip he a satisfiable 3Sat instance with n variables and m > n clauses. Then 
one can prove the satisfiability of ip, with perfect completeness and constant soundness, using 
O (y^polylogm) unentangled quantum proofs, each with O {log m) qubits. 

In particular, if m = O (n)p then we get an almost-quadratic improvement over the best known 
witness size in the classical world (or for that matter, in the quantum world with one prover). 

Obviously, Theorem [1] does not immediately generalize to all NP-complete problems, since the 
blowup in reducing to 3Sat could be more than quadratic. It is an interesting question for which 
NP-complete problems an analogue of Theorem [1] holds and for which it does not. 

We now explain the intuition behind Theorem [H The first step in our protocol is to reduce 
3Sat to a more convenient problem called 2-Out-Of-4-SAT, where every clause has exactly four 
literals, and is satisfied if and only if exactly two of the literals are. We also want our 2-OuT- 
Of-4-SAT instance to be a POP: that is, either it should be satisfiable, or else at most a 1 — e 
fraction of clauses should be satisfiable for some constant e > 0. Finally we want the instance to be 
balanced, meaning that every variable occurs in at most a constant number of clauses. Fortunately, 
we can get all of this via known classical reductions, including the "tight" POP Theorem of Dinur 
|llj . which increase the number of variables and clauses by at most a polylogm factor. 

So suppose Arthur has applied these reductions, to obtain a balanced 2-Out-Of-4-SAT POP 
instance 4> with A^ variables. And now suppose Merlin sends Arthur a log A^-qubit quantum state 
of the form 



^E(-i) 



N 

N . , 
1=1 

where xi, . . . , xn S {0, 1} is the claimed satisfying assignment for (j). (We call a state having the 
above form a proper state.) Then we show that Arthur can check the veracity of xi, . . . , xn with 
perfect completeness and constant soundness. To do so, Arthur simply measures \ip) in a basis 
corresponding to the clauses of (j). With constant probability, he will get an outcome of the form 



(_!)-» |i) + (-1)--^ li) + (-!)-■'= \k) + (-1) 



Xl 



where {i,j,k,i) is a randomly chosen clause of (p. Assuming this occurs, Arthur can perform 
a measurement that accepts with certainty if Xj -|- Xj -|- x^ -|- x^ = 2 and rejects with constant 
probability otherwise. 

Thus, if only Arthur could somehow assume \ip) was proper, we would have a logA^-qubit 
witness for 3Sat! The problem, of course, is that Arthur has no way of knowing whether Merlin 
has cheated and given him an improper state. For example, what if Merlin concentrates the 
amplitude of 1-0) on some small subset of basis states, and simply omits the other basis states? 



*Note that setting m = O (n) is fairly common in the study of 3Sat, and indeed, the "hardest" random 3Sat 
instances are believed to occur around m « 4.25n. 



Our key technical contribution is to show that, if Arthur gets not one but 0{\'N) copies of 
li/j), then he can check with constant soundness whether \ip) is proper or far from any proper 
state. Indeed, even if Arthur is given K = O(viV) states \ipi) , . . . , \^k) which are not necessarily 
identical, so long as the states are not entangled with each other Arthur can check with constant 
soundness whether most of them are close to some proper state {tp). This then yields a protocol 
for 3Sat with constant soundness and 0{VN) unentangled proofs of size O(logA^) — for Arthur 
can just choose randomly whether to perform the satisfiability test described above, or to check 
whether most of the |(/3fc)'s are close to some proper state \il>). 

To check that most of the states are at least close to each other, Arthur simply has to perform 
a "swap test" between (say) \(pi) and a random other state \(pk)- So the problem is reduced to 
the following: assuming most of the |(/3fc)'s are close to \(pi), how can Arthur decide whether \ipi) is 
proper or far from any proper state? 

In our protocol, Arthur does this by first choosing a matching Ai on the set {1, . . . , N} uniformly 
at random. He then measures each state \(pk) in an orthonormal basis that contains the vectors 
\i) + \j) and |i) — \j) for every edge (z, j) G Ai. 

Let us think about what happens when Arthur does this. Since he is performing 0(\/iV) 
measurements on almost-identical states, and since each measurement has A^ possible outcomes, by 
using a suitable generalization of the Birthday Paradox one can prove that with ri (1) probability, 
Arthur will find a collision: that is, two outcomes of the form |i) it \j) , for the same edge {i,j) G M. 



N 



I 



So suppose this happens. Then if the |¥?fc)'s are all equal to a proper state {ip) = X]i=i (~1 
the two outcomes will clearly "agree": that is, they will either both be \i) + \j) (if Xj = Xj) or both 
be \i) — \j) (if Xi ^ Xj). On the other hand, suppose the \(pk)^s are far from any proper state. In 
that case, we show that the outcomes will "disagree" (that is, one will be \i) + \j) and the other 
will be \i) — \j)) with Q (1) probability. 

To understand why, consider that there are two ways for a state \ip) = Y2i=i ^i K) t° ^^ ^^^ from 
proper. First, the probability distribution (|ai| ,...,|aAf| ), which corresponds to measuring 



\ip) in the standard basis, could be far from the uniform distribution. Second, the Oj's could be 
roughly equal in magnitude, but they could have complex phases that cause \ip) to be far from 
any state involving positive and negative real amplitudes only. In either case, though, if Arthur 
measures according to a random matching A4 , then with high probability he will obtain an outcome 
Ui \i) + Qj \j) that is not close to either \i) + \j) or \i) — \j). 

As one would imagine, making all of these claims quantitative and proving them requires a good 
deal of work. 

The reason we need the assumption of unentanglement is that without it, cheating Merlins 
might correlate their states in such a way that a swap test between any two states passes with 
certainty, and yet no collisions are ever observed. As we point out in Section 13.71 it seems unlikely 
that the assumption of unentanglement can be removed, since this would lead to a 2 ^^™''-time 
classical algorithm for 3Sat. On the other hand, we believe it should be possible to improve our 
protocol to one involving only two unentangled proofs. This is a problem we leave to future work. 

1.4 Weak Additivity Implies Amplification 

In the one-prover case, it is easy to amplify a QMA protocol with constant error to a protocol 
with exponentially small error. Merlin simply sends Arthur m = poly (n) copies of his proof; then 
Arthur checks each of the copies and outputs the majority answer. To show that this works, the 



key observation is that Merlin cannot gain anything by entangling the m proofs. Indeed, because of 
the convexity of Arthur's acceptance probabihty, Merhn might as weU send Arthur an unentangled 
state IV') , in which case the completeness and soundness errors will decrease exponentially with 
m by the usual Chernoff bound. 

Now suppose we try the same argument for QMA (2). If we ask each Merlin to send m copies 
of his state, each Merlin might cheat by instead sending an entangled state on m registers. And 
in that case, as soon as Arthur checks the first copy (consisting of one register from Merlin^i and 
one from Merlin^), his doing so might create entanglement in the remaining copies where there 
was none before! This is because of a counterintuitive phenomenon called entanglement swapping 
|30j . by which two quantum systems that have never interacted in the past can nevertheless be- 
come entangled, provided those systems are entangled with other systems on which an entangling 
measurement is performed. 

Let us give a small illustration of this phenomenon. Suppose that each "proof is a single qubit, 
and that Arthur asks for two proofs from each Merlin (thus, 4 qubits in total). Then if Merlin^ 
is dishonest, he might send Arthur the entangled state \tpA) = |00) + |11), and likewise Merlin^ 
might send Arthur IV'b) = |00) + |11) (omitting normalization). Now suppose Arthur measures 
the qubits \iIja)(i\ and \ipB)n) in the "Bell basis," consisting of the four entangled states |00) + |11), 
|00) — 1 11), |01) + 1 10), and |01) — |10). Then conditioned on the outcome of this measurement, it 
is not hard to see that the joint state of |V'a)(2) and \'4^b)(2) '^iH also be entangledo 

Of course, as soon as the remaining m — 1 copies become entangled, we lose our soundness 
guarantee and the proof of amplification fails. 

Nevertheless, there is a natural amplification procedure that seems like it ought to be robust 
against such "pathological" behavior. Suppose Arthur chooses the number of copies m to be very 
large, say n^^ (much larger than the number of copies he is actually going to check), and suppose 
that each copy he does check is chosen uniformly at random. Then whatever entanglement Arthur 
produces during the checking process ought be "spread out" among the copies, so that with high 
probability, every copy that Arthur actually encounters is close to separable. 

It follows, from the "finite quantum de Finetti theorem" of Konig and Renner [20 j, that if the 
number of copies were large enough then the above argument would work. Unfortunately, the 
number of copies needs to be exponential in n for that theorem to apply. 

We will show that the argument works with poly (n) copies, provided one can formalize terms 
like "spread out" and "close to separable" using a suitable measure of entanglement. The only 
problem, then, is that a measure of entanglement with the properties we want is not yet known to 
exist! Informally, we want an entanglement measure E that 

(i) is superadditive (meaning it "spreads itself out" among registers), and 

(ii) is faithful (meaning if E (p) is polynomially small then p is polynomially close to a separable 
state in trace distance). 

Among existing entanglement measures, there is one — the entanglement of formation Ep, intro- 
duced by Bennett et al. [6j — that is known to satisfy (ii), and that until recently was conjectured to 



^Indeed, this example can be seen as a special case of quantum teleportation [5]: Arthur uses the entanglement 
between MerliUyi's left and right registers, as well as between Merlins 's left and right registers, to teleport an entangled 
state into the two right registers by acting only on the two left registers. 



satisfy (i)|j This conjecture is known to be equivalent to the Additivity Conjecture from quantum 
information theory [27]. Thus, an earher version of this paper assumed the Additivity Conjecture 
in proving several results. 

In a dramatic recent development, Hastings |13j has shown that the Additivity Conjecture is 
false. Fortunately, our results require only weak, asymptotic versions of the Additivity Conjecture, 
which we still conjecture are true, and which are stated formally in Section [4.11 

Our first result says that, if a weak Additivity Conjecture holds, then any QMA (2) protocol 
can be amplified to exponentially small error. We also prove, unconditionally, that any QMA (A;) 
protocol with constant soundness can be simulated by a QMA (2) protocol with 17 (1/A;) soundness. 
Combining these two results, we find that if a weak Additivity Conjecture holds, then QMA (k) = 
QMA (2) for all k > 2|I| Another interesting consequence we get is that, assuming a weak Additivity 
Conjecture, k Merlins who all send copies of the same witness yield the same computational power 
as k Merlins who can send different witnesses. 

1.5 Nonexistence of Perfect Disentanglers 

While we now have a few examples where multiple quantum proofs seem to help — such as the 
3Sat protocol of this paper, and the pure state A^-representability problem [21] — we still have no 
"complexity-theoretic" evidence that QMA (2) ^ QMA. Indeed, even proving an oracle separation 
between QMA (2) and QMA seems extremely difficult. 

Thus, let us consider the other direction and try to prove these classes are the same. Potentially 
the first approach would be to equip Arthur with a disentangler: that is, a quantum operation that 
would convert Merlin's (possibly-entangled) witness into a separable witness, and thereby let Arthur 
simulate a QMA (2) protocol in QMA. In this paper we take a first step in the study of disentanglers, 
by proving that in finite-dimensional Hilbert spaces, there is no operation that produces all and 
only the separable states as output. 

Note that, if we are willing to settle for there being an output close to every separable state, 
then a disentangler does exist: simply take as input a classical description of the separable state a 
to be prepared, measure that description in the computational basis, and then prepare ao 

Likewise, if we are willing to settle for every output being close to a separable state, then a 
disentangler also exists. For some sufficiently large A^, take as input a quantum state on registers 
Rq, Ri, . . . , Rn, choose an index i £ [N] uniformly at random, and output the joint state of Rq and 
Ri (discarding everything else). It follows, from the finite quantum de Finetti theorem [20], that 
with high probability this state will be close to separable. 

The key problem with both of these approaches is that the input Hilbert space needs to be 
exponentially larger than the output Hilbert space. In the case of the "de Finetti approach," this 
follows from considering the maximally antisymmetric state 

1 ^ i-lf^-('^)\ail))...\aiN)), 



There is also another measure — the squashed entanglement Esq, introduced by Christandl and Winter [10] — that 
is known to satisfy (i), but unfortunately can be shown not to satisfy (ii). 

''Kobayashi et al. (personal communication) have shown independently of us that if QMA (2) protocols can be 
amplified to exponentially small error, then QMA (k) — QMA (2) for all k > 2. 

This example also shows that our result fails if the input space is infinite-dimensional — for then one could give 
an infinitely-precise description of a. 



which has the properties that 

(i) there are exponentially many registers (as a function of n = log N, the size of a given register), 
but 

(ii) the reduced state of any two registers is far from a separable state. 

Watrous (personal communication) has conjectured that this exponentiality is an unavoidable 
feature of any approximate disentangler. Proving or disproving this remains one of the central 
open problems about QMA(2). 

1.6 Table of Contents 

The rest of the paper is organized as follows. 

Section [2] Preliminaries 

Section [3] Proving 3Sat with O {\/rn) qubits 

Section [4] Weak additivity implies amplification (as well as QMA(A;) = QMA(2), etc.) 

Section [5] Nonexistence of perfect disentanglers 

Section [6] List of open problems 



2 Preliminaries 

In this section, we first define the complexity class QMA (A:, a, b), or Quantum Merlin- Arthur with k 
unentangled witnesses and error bounds a, b, and state some basic facts and conjectures about this 
class. We then survey some concepts from quantum information theory we will need, including 
trace distance, superoperators, and the swap test. 

2.1 Multiple-Prover QMA 

Definition 2. A language L is in QMA (k, a, b) if there exists a polynomial-time quantum algorithm 
Q such that for all inputs x G {0, 1}".- 

(i) If X G L then there exist witnesses \^pl) , . . . ,\^pk), with poly (n) qubits each, such that Q 
accepts with probability at least b given \x) |^i) • • • (8i \ipk)- 

(ii) If X ^ L then Q accepts with probability at most a given \x) iV'i) ® • • • ^ IV'fc); for all 

\i^i) , ■ ■ ■ Ai'k) ■ 

As a convention, we also define QMA(fc) := QMA (A;, 1/3, 2/3), and QMA := QMA(1)|1 



®For purposes of definition, we assume we have fixed a specific machine model (e.g., a universal set of quantum 
gates) — though if the Amplification Conjecture to be discussed shortly holds, then this choice will turn out not to 
matter. 



The above definition makes sense for all integers k from 1 up to poly (n), and nonnegative real 
functions 2-P°iy(") < a{n) < b{n) < 1 - 2-P°iy("). 

In the one-prover case, we know that QMA (1, 1/3, 2/3) = QMA (l, 2-p("), 1 - 2-P(")) for all 
polynomials/? (see [22] for example). This is what justifies the convention QMA (1) = QMA (1, 1/3, 2/3). 
By contrast, we do not yet know whether the convention QMA (k) = QMA (k, 1/3, 2/3) is justified 
for k >2. That it is justified is the content of the following conjecture: 

Conjecture 3 (Amplification). QMA (A;, a, 6) = QMA (A:, 2-P("), 1 - 2-p(")) for all k, all a < b 
with b — a = Vt (1/poly {n)), and all polynomials p. 

One is tempted to make an even stronger conjecture: that the entire hierarchy of QMA (/c, a, 6)'s 
we have defined collapses to just two complexity classes, namely QMA and QMA (2). 

Conjecture 4 (Collapse). QMA {k, a, b) = QMA (2, 2-P("), 1 - 2-P(")) for all k>2, all a < b with 
b — a = ^ (1/ poly {n)), and all polynomials p. 

The main progress so far on these conjectures has been due to Kobayashi et al. [19], who showed 
that the Amplification and Collapse Conjectures are actually equivalent: 

Theorem 5 ( |19| ). Conjecture\M implies Conjecture^ 

Let us observe that one can make the completeness error (though not the soundness error) 
exponentially small, using a simple argument based on Markov's inequality. We will need this 
observation in Section 31 

Lemma 6. QM/\{k,a,b) C QMA (A;, 1 - (6 - a) , 1 - 2-p(")) for all k, all a < b < 1, and all 
polynomials p. 

Proof. We use the following protocol. Each Merlin provides m = C ■ ,F I2 registers for some 
constant C. Then Arthur runs his verification procedure m times in parallel, once with each k- 
tuple of registers, and accepts if and only if at least a d fraction of invocations accept, for some d 
slightly less than b. 

To show completeness, we use a Chernoff bound. Assuming the Merlins are honest, each one 
simply provides m copies of his witness. Then on each invocation, Arthur accepts with independent 
probability at least b. So assuming we chose a sufficiently large constant C, the probability that 
Arthur accepts less than dm times is at most 2"^'"'. 

To show soundness, we use Markov's inequality. The expected number of accepting invocations 
is at most am (by linearity of expectation, this is true even if the registers are entangled). Hence the 
probability that this number exceeds dm is at most a/d, which we can ensure is less than 1 — (6 — a) 
by choosing d S ( xTrrfz^) bj (note that such a d must exist by the assumption a < 6 < 1). D 

2.2 Quantum Information 

We now review some quantum information concepts that we will need. For more details see Nielsen 
and Chuang [23] for example. 

Given two mixed states p and a, their trace distance is \\p — (t||^j. := i Yli=i l'^*!' where (Ai, . . . , A„) 
are the eigenvalues of p — cr. We say a is e-close to p if ||p — (j\\^^ < e, and e-far otherwise. The 
importance of trace distance comes from the following fact: 



Proposition 7. Suppose a is e-close to p. Then any measurement that accepts p with probability 
p, accepts a with probability at most p + e. 

Trace distance also satisfies the triangle inequality: 

Proposition 8. \\p - a\\^^ + \\a - ^\\^^ > \\p - £,\\^^ for all p, a, ^. 

Given a pure state \il)) and a mixed state /?, their squared fidelity (■(/'|p|V') is the probability of 
obtaining |V') as the result of a projective measurement on p. Squared fidelity behaves nicely under 
tensor products: 

Proposition 9. Given a k-partite state p^i^2--Afe^ suppose there are pure states |V'i) , • • • , IV'fe) such 
that ('^ilp^'lV'j) > 1 — £« for all i. Let \^) := |^i) • • • \ipk) and e := ei + • • • + e^. Then 

Proof. We can assume without loss of generality that |^j) = |0) for all i. Then each p % when 
measured in the standard basis, yields the outcome |0) with probability at least 1 — ej. By the 
union bound, it follows that p^i^2---Afc^ when measured in the standard basis, yields the outcome 
1$) = \Q)®^ with probability at least 1-e. Hence (^|/9^i^2-Afe|^^^ > 1 - e. D 

Trace distance and squared fidelity are related to each other as follows: 

Proposition 10. {ip\p\ip) + \\p — \ip) (V'llltr — ^ f^'^ '^^^ P ^^'^ W) ■ 

The most general kind of operation on quantum states is called a superoperator. Any su- 
peroperator $ acting on n qubits can be expressed in the following operator-sum representation: 

<^ ip) = Et\ E^pEj, where Zf=i EJE, = I. 

Given a product state p a, the swap test is a quantum operation that measures the overlap 
between p and a. The test accepts with probability — ^ ^^^d rejects otherwise. The swap test 
can also reveal information about the purity of a state, as follows: 

Proposition 11. Suppose (iplplip) < 1 — e for all pure states {ip). Then a swap test between p and 
any other state rejects with probability greater than e/2. 

Proof. Choose a basis that diagonalizes p, so that p = diag (Ai, . . . , Xn) where Ai, . . . , Xn are p's 
eigenvalues. By assumption, Aj < 1 — e for every i. So given any mixed state a, a swap test 
between p and a accepts with probability 



1 + tr (pa) 1 1 ^-^ 1 1 — e ■r-^ e 

2 = 2 + 2 Z^^^^^^ < 2 + ^- Z^^^^ = ^ - 2- 



D 



3 Proving 3SAT With Quadratically Fewer Qubits 

We now present our protocol for proving the satisfiability of a 3Sat instance of size m, using 
O (\/m) unentangled quantum proofs with O (log m) qubits each. For ease of presentation, the 
protocol will be broken into a sequence of four steps: 
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(1) In Section [3.11 we give a sequence of classical reductions, from the original 3Sat problem to 
a different NP-complete problem that we will actually use. 

(2) In Section 13.21 we describe a protocol for the special case where Merlin's message to Arthur 
is "proper": that is, of the form -j= X]i=i (—1)^' |^) for some Boolean xi, . . . , xn- 

(3) In Section [3. 3[ we generalize our protocol to the case where the Merlins send Arthur O (y/m) 
witnesses, which are not necessarily proper but which are guaranteed to be identical to each 
other. 

(4) In Section [3.51 we remove the restriction that the states be identical. 

We end in Section [3.71 with some general observations about our protocol and the prospects for 
improving it further. 

3.1 Classical Reductions 

It will be convenient to work not with 3Sat but with a related problem called 2-Out-Of-4-SAT, 
in which every clause has exactly four literals, and is satisfied if and only if exactly two of the 
literals are. We will also need our 2-Out-Of-4-SAT instance to be a PCP, and to be balanced 
(that is, every variable should appear in at most O (1) clauses). The following lemma shows how to 
get everything we want with only a polylogarithmic blowup in the number of variables and clauses. 

Lemma 12. There exists a polynomial-time Karp reduction that maps a 3Sat instance ip to a 
2-Out-Of-4-SAT instance (f), and that has the following properties: 

(i) If if has n variables and m > n clauses, then cf) has O {m polylog m) variables and O {m polylog m) 
clauses. 

(a) Every variable of (p occurs in at most c clauses, for some constant c. 

(Hi) The reduction is a PCP (meaning that satisfiable instances map to satisfiable instances, while 
unsatisfiable instances map to instances that are e-far from satisfiable for some constant 
e>0). 

Proof. Given a 3 Sat instance (/?, we first amplify its soundness gap to a constant using the celebrated 
method of Dinur [11] . Next we use a reduction due to Papadimitriou and Yannakakis [25] , which 
makes every variable occur in exactly 29 clauses, without destroying the soundness gap. Finally we 
use a gadget due to Khanna et al. [H], which converts from 3Sat to 2-Out-Of-4-SAT, without 
destroying either the soundness gap or the property of being balanced. Note that the reduction of 
Dinur [TT] incurs only a polylogarithmic blowup in the total size of the instance, while the other 
two reductions incur a constant blowup. D 

3.2 The Proper State Case 

Suppose Arthur has applied Lemma [T21 to obtain a balanced 2-Out-Of-4-SAT instance (p with 
N = O (?7i polylog m) variables, M = O (?7i polylog m) clauses, and a constant soundness gap e > 0. 
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And now suppose Merlin sends Arthur a log A^-qubit state of the form 

N 






1=1 

where xi, . . . , xn G {0, 1} is a claimed satisfying assignment for </>. Call a state having the above 
form (for some Boolean Xj's) a proper state. Then we claim the following: 

Lemma 13. Assuming \'tp) is proper, Arthur can check whether (/) is satisfiable with perfect com- 
pleteness and constant soundness. 

Proof. To perform the check, Arthur uses the following Satisfiability Test. First he partitions the 
clauses of (p into a constant number of blocks Bi, . . . ,Bs, such that within each block, no two 
clauses share a variable. Such a partition clearly exists by the assumption that (j) is balanced, and 
furthermore can be found efficiently (e.g., using a greedy algorithm). Next he chooses one of the 
blocks Br uniformly at random, and measures {ip) in an orthonormal basis with one projector for 
each clause in Br. Because a single block in the partition of clauses does not necessarily cover all 
the variables, it is possible that the measurement result will not correspond to any clause in Br, in 
which case Arthur accepts. However, suppose that the measurement yields the following reduced 
state, for some random clause Cijke '.= {i,j,k,i) in Br- 

Notice that, of the 16 possible assignments to the variables {xi,Xj,Xk,xe), six of them satisfy 
Cijk£, and those six lead to three states \ipijke) that are orthogonal to one another (as well as the 
negations of those states, which are essentially the same). It follows that Arthur can perform a 
projective measurement on \ipijki), which accepts with probability 1 ifCij^e is satisfied, and rejects 
with constant probability if Cij^e is unsatisfied. Furthermore, because the number of blocks Br is 
a constant, each of the M clauses of (p is checked in this test with probability 0, (1/M). And we 
know that, if xi, . . . , x^v is not a satisfying assignment for (j), then a constant fraction of the clauses 
will be unsatisfied. 

Putting everything together, we find that if (f> is satisfiable, then the Satisfiability Test accepts 
1^) with probability 1; while if (p is unsatisfiable, then it rejects with constant probability. D 

3.3 The Symmetric Case 

Thus, the problem we need to solve is "merely" how to force Merlin to send a proper state. For 
example, how can Arthur prevent a cheating Merlin from concentrating the amplitude of 1-0) on 
some subset of basis states for which the Satisfiability Test accepts, and omitting the other basis 
states? 

To solve this problem, Arthur is going to need more Merlins. In particular, let us suppose 
there are K = @{VN) unentangled Merlins, who send Arthur logA^-qubit states |c^i) , . . . , jc^^^) 
respectively. By convexity, we can assume without loss of generality that these states are pure. 
For the time being, we also assume that the states are identical; that is, \{pi) = \ip) for all i € [K]. 
Given these states, Arthur performs one of the following two tests, each with probability 1/2: 
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Satisfiability Test: Arthur chooses any copy of \<p), and performs the Satisfiabihty 
Test described in Section 13.21 

Uniformity Test: Arthur chooses a matching M on [A^] uniformly at random. He 
then measures each copy of \(p) in an orthonormal basis, which contains the vectors 

\i) + \j) \i)-\J) 



V2 ' V2 

for every edge (i, j) G ^A. If for some {i,j) G A4, the two outcomes 1 and 1 
both occur among the K measurement outcomes, then Arthur rejects. Otherwise he 
accepts. 

It is clear that the above protocol has perfect completeness. For if (j) is satisfiable, then the 
Merlins can just send K copies of a proper state {tp) corresponding to a satisfying assignment for 
(f>. In that case, both tests will accept with probability 1. Our goal is to prove the following: 

Theorem 14. The protocol has constant soundness (again, assuming the \(pi) 's are all identical). 

To prove Theorem [Ml we need to show that if (p is unsatisfiable, then one of the two tests rejects 
with constant probability. There are two cases. First suppose \ip) is e-close in trace distance to 
some proper state \^p). Then provided we choose e > sufficiently small, Lemma [T3l combined 
with Proposition [71 already implies that the Satisfiability Test rejects with constant probability. 
So our task reduces to proving the following: 

Claim 15. Suppose \ip) is e-far in trace distance from any proper state \ip) , for some e > 0. Then 
the Uniformity Test rejects with some constant probability S (e) > 0. 

In analyzing the Uniformity Test, we say that Arthur finds a collision if he obtains two mea- 
surement outcomes of the form \i) =b \j) for the same (i, j) pair, and that he finds a disagreement 
if one of the outcomes is \i) + \j) and the other is \i) — \j). Of course, finding a disagreement is 
what causes him to reject. 

The first step, though, is to lower-bound the probability that Arthur finds a collision. Let 
\ip) = ai|l) + ••• + aAr|A^). Then for every copy of \ip) and every edge {i,j) G M., Arthur 
measures an outcome of the form \i) it \j) with probability \ai\ + \aj\ , and these outcomes are 
independent from one copy to the next. We are interested in the probability that, for some (i,j) 
pair, Arthur measures \i) it \j) more than once. But this is just the famous Birthday Paradox, 
with K = 0(v]V) "people" (the copies of \ip)) and N/2 "days" (the edges in A1). The one twist is 
that the distribution over birthdays need not be uniform. However, a result of Bloom and Knight 
[8] shows that the Birthday Paradox occurs in the nonuniform case as well: 

Lemma 16 (Generalized Birthday Paradox [8j). Suppose there are N days in the year, and each 
person's birthday is drawn independently from the same distribution (not necessarily uniform). 
Then if there are @{\/N) people, at least two of them share a birthday with Q (1) probability. 
(Indeed, the probability of a collision is minimized precisely when the distribution over birthdays is 
uniform.) 

Therefore Arthur finds a collision with constant probability. The hard part is to show that he 
finds a disagreement with constant probability. Here, of course, we will have to use the fact that 
\(p) is e-far from proper. 
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For now, let us restrict attention to two copies of \ip). For each edge {i,j) G Ai, define the 
"disagreement probabiUty" 

2 



V2 


2 


V2 



|2 , I |2^"^ 



\oii\ + \a 



3\ 



to be the probabiUty that, conditioned on measuring two outcomes of the form \i) it |j), one of the 
outcomes is \i) + \j) and the other one is \i) — \j). Also, say an edge (z,j) G 7W is c-unhalanced 
with respect to \^) if Pij > c, and let 5c C A^ be the set of c-unbalanced edges. Say that a set of 
edges 5 C A^ is d- large with respect to \if) if 



y^ Moil^ + la^n > d. 



Then the key fact is the following: 



Theorem 17. Suppose \(p) is e-far in trace distance from any proper state. Then Sc is d-large 
with respect to \ip) with probability at least 1/3 over the choice of M., for some constants c and d 
depending on e. 

The proof of Theorem 1171 is deferred to the next section. 

Assuming Theorem Wf\ we can complete the proof of Claim [T5t and hence of Theorem [TH The 
idea is this: when Arthur performs the Uniformity Test, simply discard all measurement outcomes 
that are not of the form \i) it \j) for some (i, j) E Sc- Assuming Sc is d-large — which it is 
with constant probability by Theorem [T7] — with overwhelming probability that still leaves Q{vN) 
"good" measurement outcomes. Then by Lemma [T6l with constant probability there will be a 
collision among these good outcomes. And by the definition of 5c, any such collision will also be 
a disagreement with constant probability, thereby causing Arthur to reject. 

3.4 Unbalanced Edges in Random Matchings 

The goal of this section is to prove Theorem 1171 which we now restate in a more careful way. 

Theorem. There exist constants c, d > for which the following holds. Let N be even and 
sufficiently large. Suppose the state \(p) = ai |1) + • • • + un \N) is e-far in trace distance from any 
proper state (that is, any state of the form -y= X]i=i (—1)^' \i) where xi, . . . , xn G {0, 1}). Let M. 
be a matching on [N\ chosen uniformly at random, and let 5 be the set of edges {i,j) £ M that are 
"ce^ -unbalanced, " meaning that 



la? 



a]f>2ce^(\aif + \aj\'^) . 



Then 



V^ ( I a j I + I Oj I j > de' 
with probability at least 1/3 over the choice of Ai. 
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Given a state \ip) = ai\l) + ■ ■ ■ + a^ \N), define the nonuniformity of \ip) to be 

N 



NU 



i\^))--=\Y. 



i=l 



ai 



1 

N 



Intuitively, NU ( 1 92) ) measures whether the distribution induced by measuring 1 99) in the standard 
basis is close to uniform or not. We will divide the proof of Theorem [T7] into two cases: first that 
NUdv?)) > e^/100 (the "nonuniform case"), and second that NU(|v9)) < e^/100 (the "uniform 
case"). 

3.4.1 The Nonuniform Case 

We now prove Theorem 1171 in the case NUd^j)) > e^/100. For convenience, define k := e^/100 
and Pi := \ai\ . Then the condition 

I a^ — a^ I > 2ce^ M Oj | + | aj | 

is equivalent to 

p^ +P^j-2 Re afaj^ > 2ce^ {pi +Pjf , 

which will certainly be true whenever {pi — Pj) > 2ce^ (pi + Pj) , or equivalently 

Pi Pi ^ 2 + 2ce^ 
Pj Pi ~ 1 — 2ce^ 

(If Pi = or Pj = then we stipulate that the above inequality holds.) Thus, it suffices to prove 
the following classical lemma. 

Lemma 18. Let N be even and sufficiently large. Let (pi, . . . ,pn) be a probability distribution, 
and suppose 



N 



lY. 



i=l 



P'-J^ 



> K. 
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Let M be a uniform random matching on [N], and let S be the set of edges {i,j) G A4 such that 
Pi/Pj +Pj/Pi > 2 + K^/16. Then 

Yl (Pi+Pj) ^ 

with probability at least 1/3 over A^. 

Let H (the "heavy elements") be the set of i G [N] such that pi > 1/N, and let H* <Z H (the 
"very heavy elements") be the set of i G [A^] such that pi > — -^^- Let L (the "light elements") 
be the set of i G [A^] such that pi < 1/N, and let L* C L (the "very hght elements") be the set of 
i G [N] such that pi < ~^' . Clearly 



J6-ff ^ ^ iGL ^ 



Using this, we can prove two simple facts: that there are il {N) very light elements, and that the 
very heavy elements have total weight $7 (k). 
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Proposition 19. \L*\ > kN/2. 
Proof. We have 

^^ = y(--P^)<— + {\L\ - \L*\) —. 

Now use \L\ < N and rearrange. D 

Given any subset A C [N], define the "weight" of A to be Wa '■= YlieAPi- 
Proposition 20. Wh- > k/2. 
Proof. We have 

Now subtract k/2 from both sides. D 

To prove Lemma [TSl we divide into two cases. 

The first case is that \H\ > N/2 (in other words, at least half the elements are heavy). In 
this case, we begin constructing the matching Ai by randomly assigning partners to the "very light 
elements" i £ L* . Recall from Proposition [19] that \L*\ > kN/2. So by a standard Chernoff 
bound, it is easy to see that at least (say) \L*\ /6 elements i £ L* will be matched to partners 
j £ H, with probability 1 — o(l) over M. Notice that every edge {i,j) with i £ L* and j £ H 
satisfies pt < "j^' and pj > 1/N, and therefore 

Pi Pi I . 1 K^ 

Pj Pi 1 - k/4 16 

Thus, all of these edges go into the set S. We then have 

\T*\ 1 K- 

(Pi + Pi) > - — - ■ — > — 

and are done. 

The second case is that \H\ < N/2 (in other words, there are more light elements than heavy 
ones). In this case, we begin constructing Ai by randomly assigning partners to the "very heavy 
elements" i £ H* . Let B be the set of elements i £ H* that get matched to partners in H. Then 
since \H\ < N/2, every element of H* goes into B with probability less than 1/2, and hence 



Pi_ _ Wh' 
M ^-^ 2 



eIWbKEt 



iei/* 
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Therefore 

Pr \wb > -^Wh] < \ 
My 4 J -J 

by Markov's inequality. In other words, with probabihty greater than 1/3, at least 1/4 of the 
probability weight in H* gets matched to partners in L. Suppose this happens. 

Notice that every edge [i^j) with i € H* and j (i L satisfies pi > — ^^^ and pj < 1/iV, and 
therefore 

Pi Pi I 1 n'^ 

Pj Pi 1 + k/2 8 

Thus, all of these edges go into the set S. Furthermore, by the assumption Wb < ^Wh*, we have 

{i,j)&S ieH*\B 

and are done. 

3.4.2 The Uniform Case 

We now prove Theorem [T71 for states \ip) = ai |1) + • • • + un \N) such that NU {\ip)) < e^/100. The 
first step is to define a measure of the distance from \ip) to the closest proper state, which we call 
the impropriety of \(p) or imp {\^)): 

N 
impflw)) := min > a,- — r . 

Clearly < imp (If)) < 2 for all \ip), with imp {\^)) = if and only if |(/?) is equivalent to a proper 
state up to a phase shift. We also have the following: 

Lemma 21. Suppose \ip) is e-far in trace distance from any proper state. Then impd^^)) > e^. 

Proof. By Proposition IIOI we have |((^|?/')| < yl — e^ < 1 — e^/2 for all proper states \ip). On 
the other hand, suppose imp (| 99)) < e^. Then we will construct a proper state \ijj) such that 
Kv'IV')! ^ 1 ~ £^/2, thereby obtaining the desired contradiction. 

Let r be a complex number with \r\ = 1/N that minimizes X]i=i \^i ~ ''I' ^^^ ^^^ V^ ^^ ^ 
canonical square root of r. Also let f3i := \af — r\. Then 

\(y.i + \/r| \ai - y/r\ = |af - r\ = /3i, 

which means that either \ai + ^/r\ < ^f^i or |aj — yjr\ < \f^i. So by setting the 7j's to \fr or —\fr 
appropriately, we can construct a state 1-0) = 7i |1) + • • • + In \^) that is proper up to a trivial 
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phase factor, such that |aj — 7j| < \/^ for ah i. Then 

N 

2-2\{(p\ip)\ = 2-2 ' 



< 2 



N 



N 



< 



Af AT 

AT 



i=l 



2 _ ^ 



i=l 

N 



El 



D 



\ai -7i 

i=l 

N 

= imp(|(^)) 

<.^ 

and hence |(99|V')| > 1 — e^/2 as claimed. 

In what fohows, assume imp {\<f)) > s^. 

Now as in Section 13.4.11 let pj := |qj| , and for any subset A C [A^], define the "probability 
weight" of A to be Wa '■= ZlieA^i- Also, let 5 := e^/5, and let U (the "(5-uniform subset") be the 
set of all i € [N] such that \pi — 1/N\ < 6/N. The following proposition shows that U encompasses 
"most" of \(p), whether in terms of cardinality or in terms of probability weight. 

Proposition 22. \U\ > N {l - eVlO) and Wu > 1 - 3eVlO. 

Proof. We have 

4 1 A 

— >NU(|(p)) > -(N-\U\)—, 
100 - ^^^" - 2^ ' '^ iV' 



hence 



hence 



\u\>n{i 



Wu>N{l 



506 



Ni 1 



10 



10 



N N - 10 



D 



Let 



imuTT (\ip)) := min > Iq 
\r\=i/N^/ 



be an analogue of impropriety that is restricted to the set U. By combining Lemma [21] with 
Proposition 1221 '^^ can now lower-bound imp^; {\^p))- 
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Proposition 23. iuipu {\ip)) > 3e^/5. 
Proof. For all r with |?"| = 1/A^, we have 

by Proposition [22j Hence 



impfr (Iw)) = min >^ la 



2 



> min > I a,- — r I — max > | a. 

>imp(|v3))- — 

> — . 

- 5 



D 

3>2 



We are finally ready for the geometric core of our result. Let V be a collection of vectors in 
(possibly with multiplicity), which consists of the vector (^N Re a'^ , N Im. a'^) for every i ^ U. Let 
||f II be the 2-norm of v. Then we know by the definition of U that 1 — 6 < \\v\\ < 1 + 5 for all 
V gV. We also know from Proposition 1221 that 



l^l = |f/|>iv(l-|^) >0.9iV, 
and from Proposition [23] that for all unit vectors u; G M^, 

> \\v — w\\ > > . 

^ '' " - 5 - 5 

Based on this information, we want to find two subsets X,Y <^ V, both of size fi (|^|), such that 
11^ ~ y|| = ^ (1) foi' all X £ X and y gY. 

For suppose we can do this. Then just as in Section r3.4.1l when a matching M on [N] is chosen 
uniformly at random, by a Chernoff bound it will have Q (N) edges between the subsets of [N] 
corresponding to X and Y with overwhelming probability. Assuming that happens, we will have 

q\ — o?A = r^ (1/N) for every such edge (i, j) G Ai, and hence all of these edges will get added to 
the set S. We will therefore have 



(i,i)65 

as desired. (For simplicity, we have suppressed the dependence on e here.) 
What we need, then, is the following geometric lemma. 
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Lemma 24. Let V be a collection of vectors in the plane. Suppose that 1 — 5 < \\v\\ < 1 + 5 
for every v ^ V, and that X^tieV 11^ ~ ^11 — ^1^1 Z^'" every unit vector w G M^. Then provided 
5 < k/2, there exist subsets X,Y <^V , both of size at least n \V\ /40, such that \\x — y\\ > k/20 for 
allxeX and y G y@ 

Proof. Divide the plane into K G [SO/k, 40/k] equal-sized, half-open angular sectors, centered 
about the origin. By the pigeonhole principle, one of these sectors (call it S) must contain at least 
1^1 /K > k\V\ /40 of the vectors. Let S' be the union of S and its two adjacent sectors. Then we 
claim that at least k \V\ /40 of the vectors must lie outside of S' . For suppose not. Then let z be 
the unit vector that bisects S, and let 

3 /27r\ 3 / 27r \ ttk 



2\K J - 2 \30/kJ 10 
be the angle between z and the border of S'. Notice that by the triangle inequality, we have 

\\v-z\\ < V2-2cose + 6<e + 6< ^ + S 

for every v in S' (where we have used the bound cos 9 > 1 — 0^/2). We also have Hv — z|| <2 + 5 
for every v £ V. Hence 

v(^v ves' v^s' 

<k\V\ 

which is a contradiction. 

Now let X be the set of all v's in S, and let Y be the set of all v^s outside S' . Then \X\ > 

K \V\ /40 and |y| > k\V\ /40. Also, let 

27r TTK 

^~ ^ - 20 
be the angle of a single sector. Then it is not hard to see that for all x G X and y £Y, 

\\x - y\\ > (l-S) V2 - 2 cos r > (1 - 6) -^ > (l--) ^^ > — 
" ^"-^ ^ -^ 'V2~^ 2/ 20^2 "20 

where we have used the bound cos r < 1 — t^/4 for all r G [0, 7r/2] . D 

Now set K := 3e^/5. Then 6 = e^/5 < k/2 and the condition of Lemma [24] is satisfied. So 
considering the sets X, Y from the lemma, we have 

,,,, „,, k\V\ 0.9kN (0.9)3e2iV e^N 

'''''- 40 ~ 40 ~ 200 100 ' 

and also 

K 3e2 

\\x — y\\ > — > 

" ^" - 20 ~ 100 

for all X G X and y &Y. This means that we can find subsets X',Y' C [N] such that 



^"We did not try to optimize the constants. 
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(i) |X'|,|y'| >e'^N/WO and 



af - a] 



- mm f°i' ^1^ ^ ^ ^' ^"<i J ^ ^'■ 



lOOJV 

Property (ii) implies that 

12 2|2 9e^ 8 /i 1 2 I i2\^ 

l"^-"^l - lOOOOiV^ - '"" C"^' +'"^') 

for some suitable constant c. Hence every edge {i,j) G A4 with i £ X' and j G Y' will get added 
to the set S (again assuming a suitable c). 

Property (i), together with a Chernoff bound, implies that with probability 1 — o(l) over the 
choice of matching Ai, there are at least (say) e^A^/20000 edges {i,j) G Ai such that i G X' and 
j £ Y' . Suppose this happens. Then 

-4 



y (p. +p ) > ^^ . 2 f i^^ = n (e^) 

^ \t>t fj) - 2QQQQ \ N ) ^ > 



as desired. This completes the proof of Theorem 1 17[ 

3.5 The General Case 

Of course, in general the states \(pi) ,...,|c/9x) sent by the K = @{\/7V) Merlins need not be 
identical. To deal with this, we now give our final protocol, which removes the symmetry restriction. 



The 2-OUT-OF-4-SAT Protocol 

Given \{pi) , . . . , \<Pk), Arthur performs one of the following three tests, each with 
probability 1/3. 

Satisfiabihty Test: Arthur applies the Satisfiability Test, described in Section [3.21 

to |<y9i). 

Symmetry Test: Arthur chooses an index k G {2, . . . , K} uniformly at random, 
performs a swap test between \ipi) and l^^fc)) and accepts if and only if the swap test 
accepts. 

Uniformity Test: Arthur chooses a matching M on [N] uniformly at random. He 
then measures each |c/?fc) in an orthonormal basis, which contains the vectors 

\i) + \j) \i)-\j) 



V2 ' V2 

for every edge {i,j) G M-. If for some {i,j) G ^A, the two outcomes '^' 1^' and 1^ 
both occur among the K measurement outcomes, then Arthur rejects. Otherwise 
he accepts. 



It is clear that the above protocol has perfect completeness, and thus the problem is to show 
soundness: that is, if (f) is unsatisfiable, then one of the three tests rejects with constant probability. 
There are three cases. 
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The first case is that I991) is e-close to some proper state {ip). Then as before, the Satisfiabihty 
Test will reject with constant probability, provided we choose e sufficiently small. 

The second case is that |((/3i|c/3fc)| < 1 — 5 for at least a 7 fraction of indices k £ {2, . . . ,K}. In 
that case it is clear that the Symmetry Test will reject with probability at least 7^/2. 

The third case is that | ((^1 1(^^.) \ > 1 — 6 for more than a 1 — 7 fraction of indices k E {2, . . . , K}, 
but nevertheless \ipi) is e-far from any proper state. In this case we need to generalize the results 
of the previous section, to show that the Uniformity Test will still reject with constant probability 
(dependent on e, 6, and 7). 

The first step in the analysis is simply to discard all states \fk) such that Kv^ilv^fc)! < 1 — S. 
By Proposition 1101 the remaining K' > (1 — 7) iC states are all \/2^-close to \(pi) in trace distance. 

Now given a matching Ad on [N], let Sc be the set of edges in M that are c-unbalanced with 
respect to |</?i), in the sense defined in Section [331 Then Theorem [T71 implies that Sc is d-large 
with respect to |(/?i) (for some constants c and d) with probability at least 1/3 over the choice of 
M.. Suppose that it is. 

Call a measurement outcome \i) it \j) good if (i, j) G Sc- Then when Arthur performs the 
Uniformity Test, we simply discard all states for which the outcome is not good. Since all of 
the states are v25-close to {ipi), and since Sc is d-large with respect to \(pi), with overwhelming 
probability this still leaves us with K" « (d — V26)K' states. Call those states |^i) , . . . , \£,k")- 

Let M. = {\i) ± \j) : {i,j) £ M.}. Given a state \ip), let P|(p^ be the probability distribution 
over A4 induced by measuring \ip) according to A4. Then we know that ||^|^i) — ^|^fc)|| ^ v25 
for all k € [K"]. Next let P| > be the distribution over Ai induced by measuring \lp), and then 
conditioning on the outcome being good. Then we claim that 



< ■'' 



d-V26 

for all k £ [K"], where as always ||-|| denotes the variation distance. This is so because of the 
following simple fact: 

Proposition 25. Let T>i and T>2 be probability distributions, let E be an event, and let T>[ and Pg 
denote Vi and V2 respectively conditioned on E. Suppose \\Vi — 2?2|| < k and Vi^^Vx [E {x)] > a. 
Then \\V\ -V'r,\\< ^^. 

II i ^11 — a— K 

Proof. Let b = PiCxeV2 [E (x)], and note that |a — 6| < k. Also let px = Pr^j [x] and Qx = Pr^j [x]- 
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Then 



\v\ -v'\\ = - y 

I 1 "iW ') z_^ 



Pr [x] — Pr [x] 



x:E{x) 
1 V^ \Px Qx 



V' 



x:E{x) 



^ i T. (i^^ 



+ 



x:E{x) 

K 1 I a 

<— + -!-- 

- 2b 2 1 b 

K 

< - 

- b 

K 

< . 



-Pa 



a — K 



D 



By construction, every measurement outcome \i) it \j) in the support of every DL \ corresponds 
to an edge {i,j) that is c-unbalanced with respect to \ipi). But this still leaves a key question 
unanswered: is (i,j) reasonably unbalanced with respect to \^k) itself? The following lemma will 
imply that it is, with high probability over DL \: in particular that 



Pr 



\ik) 



{i,j) is --unbalanced w.r.t. 1^^) 



> 1 



WV26 



c d 



for all k G [K"]. 



Lemma 26. Let V = {px, Qx 



ixe[N] 



andV = ip'x,q'x) 



X' 'dx)xe[N] 



be any two probability distributions over 



the set [N] x {0, 1}. Suppose that ||P — V'W < n, and that 2pxqx > c{px + Qx) for every x G [N]. 
Let S be the set of all x G [N] such that 2p^g^ > c' (p'^ + q'^) ■ Then 

8/i 



Y.{p'x + q'x)>'^ 



xes 



2c'' 



for all constants c G (0, 1/2) and d G (0, c/2). 



Proof. Assume for simplicity that Px,qx > for all x (it is not hard to remove this restriction). 



Let Ex = p'x 



Px and Sx = q'x — Qx- Then by assumption, 

N 



X](k^l + l'^^l)<2/w- 



x=l 



Let S be the complement of S. Consider an adversary with a "budget" of 2/i, who is trying to 
perturb V so as to maximize J2xeS ^P'x + I'x)- Define the "price per pound" of x to be 



P'x + Qx 
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Intuitively, $x is the amount the adversary has to "spend" on perturbing p^: and Qx, divided by the 
amount of probabiHty mass that gets added to 5 as a result. We will show that S^; > (c — 2c') /4 
for all X £ S. This will suffice to prove the lemma, since we then have 



E/ / , / \ sr^ \^x\ + \0x\ ^ 
[Px + Qx)=2_^ ^ < 



8fi 



x&S 



x£S 



2d 



We now lower-bound %x. If we simply divide through by PxQx^ the condition 2px<lx ^ c {px + Qx) is 
equivalent to Px/Qx + Qx/Px < (2 — 2c) /c. Let A = (2 — 2c) /c; then in particular, we have px < Aqx 
and Qx < Apx for all x. On the other hand, to get x £ S we need p'x/q'x + qUp'x > (^ — 2c') /c', 
and hence either p'x/q'x > -B or q'x/p'x > B where B = {1 — d) / d . 
Suppose p'x/q'x > B without loss of generality. Then 



Px + Sx > B {qx + 5x) > B [^ + 5x ] , 



which rearranging means 

Likewise 

which rearranging means 

Combining, 



£x - B6x > 



1 ]Px 



B {qx + Sx) <px+£x < Mx + ex, 



£x-B5x>{B-A)qx> [--I] qx- 



i?<5.>('|-l^^2L±^ 



and hence 



Therefore 



N + l4l>ife-B4)>(i-i)^ 



\£x\ + \5x\ 

Px + q'x 

\£x\ + \5x\ 

Px + qx + \ex\ + \5x\ 
\{l/A-l/B) 

1 + i {l/A - l/B) 
c/(2-2c)-c'/(l-c') 

2 + c/ (2 - 2c) - c'/ (1 - c') 

c - 2c' + cd 
4 - 3c - 6c' + 5cc' 
c-2c' 



> 



> 



> 



as claimed. 



D 
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We now need one last conditioning step: discard all states \^k) for which the measurement 
outcome is not c/4-unbalanced with respect to \^k)- By Lemma ESI with overwhelming probability 
this still leaves us with K'" ~ K" states (for suitable choices of c, d, and 5). Call those states 

Given any state |c^), let Pf' > be the probability distribution over \i) ± \j) £ M. obtained by 
starting from D! >, and then conditioning on the edge {i,j) being c/4-unbalanced with respect to 
\ip). Then 



^lft> ~ ^lvi> 



< 



< 



< 



%.) - %.) 



+ 



vi.,-vl 



16^ 


/26 


/ 
cid- 
\ 


J 


17^ 


^ 



+ 
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lvi> 
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for all k G \K" 



cid- 
So by the triangle inequality, 



26) 



V 



lft> 



V\ 



^.) 



< 



34V26 



c d 



for ah A;, £e [K'"]. 

So to sum up: we have K'" 



0(v A^) samples from Ai, drawn independently from probability 



distributions V/ ■, , 

Ki)' 






respectively. The distributions Pf' \ have bounded variation distance 



lft> 



from one another. We also know, because the D'/ > 's only involve c/4-unbalanced edges {i,j 
if Arthur finds a collision among the K'" samples 



that 
lb |j) for some 



Thus, the one 



(i.e., two samples of the form \i) 
{i,j)), then that collision will also be a disagreement with constant probability, 
remaining task is to show that Arthur finds a collision with constant probability. 

Showing this amounts to generalizing the Birthday Paradox still further, to the case where 
the birthday distributions are not only nonuniform but can also differ from each other by small 
amounts. In particular we want the following: 



Theorem 27. 

button over Xi 



Let Xi, . . . ,Xk he independent random variables over [N], and let T>i be the distri- 



Suppose K > 'i2yN and \\Vi — VjW < 1/10 for all i,j. Then 



Pv[3i,j:Xi = Xj]> 



1 



In Section [3T6l we present a proof of Theorem 1 2 71 based on the second moment method. (Indeed, 
our proof works even if the Xj's are only 4- wise independent.) 

By Theorem [271 Arthur will find a collision among the K'" = 0(\/iV) remaining samples with 
constant probability. Then by the definition of the T>'/ v's, this collision will be a disagreement 
with constant probability, thereby causing Arthur to reject. 

So in summary, we get a protocol with perfect completeness, constant soundness, and 0{y/rn) 
unentangled witnesses with O (log m) qubits each. 

As a final remark, we can reduce the soundness error to be negligibly small (in particular, 
2-polylogm-j_ rpQ Jq gQ^ ^g simply multiply the number of Merlins by a further polylogm, factor, 
and repeat the whole protocol polylogm times. 
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3.6 The Generalized Birthday Paradox 

The purpose of this section is to prove the Birthday Paradox, even in the very general situation 
where 

(1) the distributions over birthdays need not be uniform, and 

(2) the distributions need not be the same for every person, but only e-close in variation distance, 
and 

(3) the distributions need not be independent, but only 4-wise independent. 
First we need two lemmas. 

Lemma 28. Let 'Di,D2 be probability distributions over [n] such that ||2?i — P2II ^ £• Then 
Prx'G©i,j/G02 [x = y] > {I - ef /n. 

Proof. Let px = Prx)j [x] and let Qx = Pr^j [x] . Then 

, Pr [x = y]=Y^ PxQx 

x6[n] 

> ^ mm. {px,qxf 

xe[n] 






n 
where the third line follows from Cauchy-Schwarz. D 

Lemma 29. Let pi, ■ ■ ■ ,pk be nonnegative reals, and let r = Yli<j<kPiPiPk o-nd s = ^i^jPiPj- 
Then r^ < 2s^. 

Proof. Let 5 be the set of 6-tuples (i, j, fc, £, m, n) such that i < j, k < i, and m < n, and let TZ be 
the set of 6-tuples such that i < j < k and i < m < n. Then 

s^ = ^ PiPjPkPePmPn 

s 
while 



r^ 



y^^PiPjPkPiPmPn- 

n 
Now define a mapping from 7^ to 5, by simply swapping k and £ if k > i, or swapping i and m if 
k = £. It is easily checked that this mapping is two-to-one. Hence r^ < 2s'^ as claimed. D 

We now prove Theorem [271 which we restate for convenience. 
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Theorem. Let Xi, . . . ,Xk be A-wise independent random variables over [n], and let Di be the 
marginal distribution over Xi. Suppose K > 32-^/n and WDi — VjW < 1/10 for all i,j. Then 

FT[3i,j:Xi=Xj]>^. 

Proof. Let Yij be 1 if Xj = Xj and otherwise, and let Y := Yli<j ^ij- ^V Lemma [28| we have 



The remainder of the proof wih involve upper-bounding the second moment E [y^] . Let us write 

E [y2] = Y. E [YijYke] =T2 + n + n, 

i<j,k<e 

where tn contains the terms in which N distinct indices appear among {i,j, k, I}. It is easy to see 
that 

r2 = ^E[y,,]=E[y] 

i<j 

and (by 4-wise independence) that 

U= Yl E [^^i] E ^^ke] < E [Yf . 

i<j,k<l all distinct 

So the nontrivial part is to upper-bound t^. Let pi^x '■= Pr [Xi = x]. Also, let 

fx ■ — / ^ Pi,xPj,xPk,X7 
i<j<k 

^x ■ — / _, Pi,xPj,x: 
i<j 

and notice that Ylxeln] '^x = E [Y]. Then 

"^3 = 6^ Y Pi,xPj,xPk,x 
i<j<k x£[n\ 

x£[n] 

<6 J]^/24 

x£[n] 



^40 

xe[n] 






^ 6^ I?i E ^- + 12 5^ .a 



xG[n\ 



6^(^^ + 12E[y] 
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Here the third hne fohows from Lemma [291 and the fourth hne follows from the basic calculus fact 
that s^'^ < ^s^ + 12s for all nonnegative s. Hence 

Pr [Y = 0]< Pr [\Y - E [y]| > E [¥]] 



< 



Pr 

Vai 

E[ 
E 


{Y-E[Y]f>E[Yf 
•[Y] 

Y^] - E [y]2 


E[Yf 
T2 + T3 + U-E [Yf 



< 



E[y]2 

E [Y] + 6^/2 (e [Yf /40 + 12 E [Y]) + E [Yf - E [Yf 



E[Yf 



< 



1 + 72^/2 6^/2 
E [Y] "^ ~W 
1 
2' 



Finally, 



Pr [3i,j : X, = X,] = 1 - Pr [Y = 0] > ^ 



and we are done. D 

3.7 General Observations 

We conclude this subsection by making three general observations about Theorem [TJ 

First, we strongly believe that our protocol can be improved to one involving two provers, one of 
whom sends O (log?n,) qubits and the other of whom sends O(-ympolylogm) qubits. Specifically, 
if all but one of the witnesses in our current protocol are entangled with one another, in a way that 
breaks the protocol's soundness, we believe Arthur should be able to use the remaining witness to 
detect this. This is a problem we leave to future work. 

Second, our protocol made essential use of the PCP Theorem, in the strong version proved by 
Dinur [11]. One might wonder whether Theorem [1] could also be proved in a "black-box" fashion, 
without exploiting anything about the structure of 3Sat. The following simple result shows that 
the answer is no — and that indeed, in the black-box setting, there is essentially no savings at all 
over the classical witness size. 

Theorem 30. Let f : {0, 1}" -^ {0, 1} be a black-box function. Then any QMA-* (k) protocol to 
convince Arthur that there exists an x such that f (x) = 1, with soundness gap ft (1/poly (n)), must 
involve n — O (log n) qubits sent by the Merlins. 

Proof Sketch. Assume without loss of generality that either / is identically zero, or else there 
exists a unique "marked item" x* such that f {x*) = 1. Suppose it were possible to convince 
Arthur that x* exists by giving him unentangled witnesses I991) , . . . , \(Pk) with Q qubits in total. 
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Then given these witnesses, Arthur's verification algorithm must query f (x*) at some time step 
with non-neghgible probabihty /3 = fi (1/poly (n)). For otherwise, by the hybrid argument of 
Bennett, Bernstein, Brassard, and Vazirani ^, Arthur's verification algorithm would not have 
Q, (1/poly (n)) soundness (i.e., Arthur would fail to detect a change in / (x*) from 1 to 0). But 
this means that Arthur's algorithm can be modified to one that uses no witnesses, and that finds 
X* with probability at least 2~^P/T. For Arthur can simply replace \ipi) , . . . , \(Pk) by the Q-qubit 
maximally mixed state, then measure at a random time step to find which x is being queried. On 
the other hand, we know from the result of Bennett et al. [4] mentioned previously that if x* is 
uniformly random, then after T queries, Arthur can have found x* with probability at most AT'^/2^. 
Solving 2-Q[5/T < 4rV2" for Q, we find that 

Q > log -^ >n-0 (log n) . 

D 

Third, notice that our protocol does not let Arthur find a satisfying assignment for ip; it only 
convinces him that such an assignment exists. If there were a way to modify our protocol to let 
Arthur recover an assignment, this would have a spectacular consequence for quantum algorithms. 
Namely, by running Arthur's verification procedure with the O {^/rn)-quhit maximally mixed state 
in place of the witnesses, we could find a satisfying assignment for ip with probability 2^ W^) ^ with 
no help from any Merlins. But this would yield a 2 '-^'"''-time quantum algorithm for 3Sat — and 
in particular, a 2 vv"''-time algorithm in the "critical regime" m = O (n)! 

4 Weak Additivity Implies Amplification 

In this section we show how to amplify any QMA (A;) protocol to exponentially small error, and to 
simulate k provers with two, assuming a weak version of the Additivity Conjecture. 

4.1 Entanglement of Formation 

The analysis of our amplification protocol will involve showing that Arthur cannot create "too 
much" entanglement during his verification procedure. To make this precise, we need some way 
to measure the entanglement of mixed states. Fortunately, this is one of the most studied topics 
in all of quantum information theory. One particular entanglement measure — the entanglement of 
formation Ep defined by Bennett et al. [B] — will be particularly useful for us. 

To define Ep we first need some other concepts. Given a mixed state u, the von Neum,ann 
entropy of cr is 5 {a) := H ({Aj}), where H {{pi}) = — X^j Pi log2 Pi is the usual entropy function and 
{Aj} are the eigenvalues of a. Given a bipartite pure state \ip^^), let a^ and a^ be the reduced 
states of the A and B registers respectively. Then it is not hard to show that S [c^) = S (c^) . We 
call this quantity the entanglement entropy of |'0^^), or E{\ip '^). We can then define Ep{p ) 
as a weighted average of entanglement entropy, minimized over all purifications of p : 

Definition 31. Given a bipartite state p^^ , the entanglement of formation Ep{p ) is the mini- 
mum of^^piEdipi)) over all decompositions p = '^^iPi \'^i) (V'il- 
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Intuitively, Ep measures the minimuni number of entangled pairs -7= (|00) + |11)) that are 

needed to prepare p . 

Almost by definition, Ep satisfies convexity: for all p and a , 

Ep {pp^^ + il-p) a^^) < pEp (/^) + {l-p) Ep (a^^) . 

It is also easy to see that Ep {p ) = if and only if p is separable. In this paper, we will need 
two further properties of Ep. The first property is what we called "faithfulness" in Section [1.41 



Lemma 32. Suppose Ep{p ) < e. Then there exists a separable state that is \ple-close to p 
in trace distance. 

Proof. Let S {p\\o') be the quantum relative entropy between mixed states p and a (see Nielsen and 
Chuang [23] for a definition). Then Vedral and Plenio [28] showed that 

i^F(/'')>min5(p^^||a^^), 

where the minimum is taken over all separable states a . Also, it is known (see Klauck et al. 
[T6] and Ohya and Petz [M]) that 

Cf AB\\ AB\ -^ ^ \\ AB A_B||2 

•J P 17 ] > - \\p — cr L . 
\r M J — 2 \\r Mtr 

Putting these results together, if Ep{p ) < e then there exists a separable state a such that 
S (/>^^||(T^^) < e, and hence ||/>^^ - ct^^H^, < V2i. D 

The second property is that, if we start from a separable state, we cannot increase the value of 
Ep much by measuring few qubits and then conditioning on the outcome. 

Lemma 33. Let p be a separable state, and suppose a is obtained from p by applying 
an arbitrary entangled measurement on at most n qubits from each register, and then possibly 
conditioning on the outcome. Then Ep (c ) < Ep [p ) + 2n. 

Proof. By convexity, we can assume without loss of generality that p is a pure state, \iPa) ® 
IV'b)- So we can write a as $ (IV'a) (V'aI) / ||*I* (|^a) (V'aDH, where <& is some non-trace-increasing 
operator acting on at most n qubits. Or in the operator-sum representation, 

^A_ EfilE^\i^A){i^A\Ej 



'^^EfilE^\^PA){^PA\Ej 
where Ya=i EJEi^I and M < 2^". We then have 

Ep (a^^) < S (a^) 

_J E^ilE^\^PA){4^A\El \ 

\^^EfiiEi\^A){MElJ 

< log2 M 

< 2n 

where the first line follows from the concavity of the von Neumann entropy. D 
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Given an entanglement measure E, we call E superadditive if for any state p '^^ on four 
registers, 

E{p^^''^^')>E{p^^)+E{p^'^'). 

As mentioned earlier, the analysis of our QMA (k) amplification protocol originally relied on the 
conjecture that Ep is superadditive. But in a spectacular recent development, Hastings [13] has 
shown that this conjecture is false. (More precisely, Hastings shows a failure of additivity for the 
minimum output entropy of a quantum channel. By a result of Shor [27J, this is equivalent to the 
super additivity of entanglement of formation.) 

However, the violation of additivity found by Hastings is extremely small, and is perfectly 
consistent with additivity being true in a weaker or asymptotic sense. To make this precise, we now 
state a version of the Additivity Conjecture that suffices for our purposes. Call an entanglement 
measure E weakly superadditive if it satisfies the relation 

k 
^ (pA^_A2-Ak,B^B2-Bk\ >-Y^ E{p^'^^), 

for some constant c independent of k. Weak superadditivity is, in particular, implied by the 
following inequality: 



^AA',BB'\ 



1 



AB\ I Tpf„AB'\ I en/ 4'Bn , TP/^A'B' 



E{^pAA,BB'^ > - E (p^^) + ^(/9^^ ) + ^(p^^) + E{p 

which in turn is implied by ordinary superadditivity. Then we conjecture the following: 

Conjecture 34 (Weak Additivity Conjecture). Ep is weakly superadditive. 

As a side note, Ep badly violates the so-called monogamy inequality E{p '^^ ) > E {p ) + 
E{p )cj As an example, consider again the maximally antisymmetric state 

|V) = ^ j; {-ir''^^~^\a{l))...\a{N)). 

The entanglement of formation between the first register of \ip) and the remaining A^ — 1 registers 
is at most log N . Yet the entanglement of formation between the first register and any one other 
register can be shown to be $1(1). Note that, had Ep satisfied the monogamy inequality, we 
would have been able to use it to show QMA (2) = QMA, using essentially the same argument as 
in footnote [3l 

A different entanglement measure — the squashed entanglement Esq of Christandl and Winter 
|10j — is known to satisfy both superadditivity and the stronger monogamy inequality. The trouble 
with Esq is that it badly violates the analogue of Lemma [321 there exist N x A^-dimensional bipartite 



"^Note that the monogamy inequahty imphes superadditivity, via 



> E{p^^) + E{p^'^) + E{p^^') + E{p^'^' 
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states p such that Esq{p ) = O ( °|r j , yet p has trace distance Q. (1) to any separable state. 
The example that shows this is once again the maximally antisymmetric state, which seems like 
the "universal counterexample" of entanglement theory! This is why we cannot use squashed 
entanglement in this paper, and must instead use entanglement of formation. 

4.2 The Two-Prover Case 

We now show that the Weak Additivity Conjecture implies the QMA (2) Amplification Conjecture. 

Theorem 35. Assume the Weak Additivity Conjecture. Then QMA (2, a, h) = QMA (2, 2~"P("), 1 - 2-^^")^ 
for allh — a = Vt (1/poly (n)) and all polynomials p. 

Proof. Let L be a language in QMA (2, a, 6); then we need to show L G QMA (2, 2~p("), 1 - 2-P(")) . 
Let Q be Arthur's verification algorithm in the original QMA (2, a, b) protocol, and let the original 
Merlins' messages have r (n) qubits each for some polynomial r. Also, let T (n) be a number of 
repetitions of Q that suffices to amplify it to error probability 2~p("\ assuming no entanglement 
among Merlin^'s or Merlin^'s registers. By a standard Chernoff bound, we can take T {n) := 
C ■ p (n) / (6 — a) for some constant C. 
Our amplified protocol is the following. 

(1) Arthur asks Merlin^ and Merlin^ to supply q (n) copies each of their respective witnesses, 
where q{n) := C • T {n)r [n] / [b — a) for some constant C". Denote by p ^ ^"' "Jt"' and 
p 1 2-- q(n) ^i^Q states on q (n) r (n) qubits that Arthur actually receives. 

(2) For alH := 1 to T (n), Arthur chooses registers Aj and Bk uniformly and independently from 
among those not already chosen, and runs Q on the state p^ *. 

(3) Arthur accepts if at least ^^T (n) of the T (n) invocations of Q accepted, and rejects other- 
wise. 

We need to show two things about this protocol, completeness and soundness. 

Completeness: If the Merlins are honest, they can simply send IV'a) and iV's) re- 

spectively, where \tpA) 'S' {iPb) is a witness that Q accepts with probability at least b. Then by 
assumption, Arthur will accept with probability at least 1 — 2"^^"^ 

Soundness: As usual, this is the interesting part. Our central claim is the following: At every 
one of the T (n) iterations, Arthur can be considered to be running Q on a bipartite state p that 

is e-close to a separable state, where e = O i \JT (n) r in) /q (n) j . 

Let us first see why soundness follows from the above claim. Suppose x ^ L. Then Q accepts 
every separable state with probability at most a. By Proposition [71 then, Q also accepts every 
state that is e-close to separable with probability at most a + e. But 



O (T{n)r{n)\^b_ 



n 



provided we chose a sufficiently large constant C when defining q{n). So every invocation of 
Q accepts with probability at most a -\ — ^. Therefore, provided we choose a sufficiently large 
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constant C when defining T (n), Arthur wih accept with probabihty at most 2"^'"^ by a ChernofF 
bound. 

We now prove the claim. By Lemma [33l the entanglement of formation between Merlin^ 's 
registers and Merlin^'s registers can be at most 2r (n) after the first iteration, at most 4r (n) after 
the second iteration, and so on. Hence 

Ef (p^i^2-^9{n).BiS2-B,(„)^ < 2T (n) r (n) 

throughout the protocol. Also, let Sa and Sb be the sets of A-registers and i?-registers respectively 
that Arthur has not yet chosen. Then \Sa\ = \Sb\ = Q (n) —T (n). Assuming the Weak Additivity 
Conjecture, we therefore have 

Y, Ef (p^^^^) = O {{q (n) - T (n)) Ef (/i^^-Aw-SiBa-s^cn))) 
= 0{T{n)r{n){q{n)-T{n))). 



So if we define 






then the convexity of Ef implies that 

\Sa\\Sb\ ,,,e^.,^„ 

= o 
= o 



AjGSA,BkeSB 
T (n) r (n) 
q (n) — T (n) 
T (n) r (n 



q{n) 



using the fact that T (n) < q (n) /2. By Lemma [32} this means that cr is O ( y^T (n) r (n) /q (n) j - 
close to a separable state, as claimed. D 

4.3 The A;-Prover Case 

In this section we show unconditionally that any QMA(/c) protocol with constant soundness can be 
simulated by a QMA(2) protocol with soundness il.{l/k). Combined with Theorem 1351 this will 
imply that assuming the Weak Additivity Conjecture, for all A; > 2 we have 

QMA {k, 1/3, 2/3) C QMA (2, a, b) C QMA (2, 1/3, 2/3) 

for some a,b with b — a = ^{1/k), and hence QMA (fc) = QMA (2). Note that Kobayashi et 
al. (personal communication) have independently shown that amplification of QMA (2) protocols 
implies QMA(/c) = QMA (2) for all k > 2. (Their earlier result only showed that amplification of 
QMA (k) protocols implies QMA (k) = QMA (2) for all k > 2, which was not strong enough for our 
purposes.) 

Theorem 36. QMA {k, a, b) C QMA (2, 1 - ^^^, 1 - 2" 
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Proof. We will show that for all k and all (5 = (1/poly (n)), 

QMA {k,l-S,l- 2"") C QMA ( 2, 1 - -r, 1 - 2" 

This will suffice to prove the theorem, since Lemma O implies that for all k and all a,b, we have 
QMA {k, a, h) C QMA (A;, 1 - (6 - a) , 1 - 2""). 

Our protocol is as follows. Merlin^ and Merlin^ send A:-partite states p^^^'^'''^^ ^^d p^^^2---Bk 
respectively. Given these states, Arthur performs one of the following two tests, each with proba- 
bility 1/2: 

(1) Choose i € [k] uniformly at random, perform a swap test between /o * and /o % and accept if 
and only if the swap test accepts. 

(2) Simulate the QMA {k,l — 6,1 — 2""") protocol, using p^i^2'""^fc in place of the k witness reg- 
isters. 

We first show completeness of the above protocol. If the Merlins are honest, they can both 
simply send k unentangled accepting witnesses for the QMA (k) protocol being simulated. In that 
case step (1) accepts with probability 1, while step (2) accepts with probability at least 1 — 2~". 

We now show soundness. Suppose any set of unentangled witnesses causes the QMA (k) protocol 
to reject with probability at least 6. Then we need to show that any pair of witnesses p"^i"^2--Afe 
and p^i^2----Bfc causes the QMA (2) protocol to reject with probability at least g^. We consider two 
cases. 

First suppose p^i^2'"^ft is e-close in trace distance to some separable pure state |^). Then by 
Proposition [Tl step (2) rejects with probability at least S — e. 

Next suppose p^i^2---As. jg g-far in trace distance from any separable pure state. Then by 
Proposition IIOI we have /^|p 1^" ''l^^ < 1 — e^ for all separable pure states |\I'). So taking the 
contrapositive of Proposition [9l for all pure states \ipi) , . . . , \^jJk) we have 



Y,{l-{^P,\p^^\^P.))>e\ 



i=l 



2 

Hence step (1) rejects with probability greater than |^ by Proposition [TTJ Setting e = 3(^/4, we 
thus find that the protocol rejects with probability at least ^ max {^ M^} > g. D 

Combining Theorem 1361 with Theorem 1351 now yields the following: 

Corollary 37. The Weak Additivity Conjecture implies the Collapse Conjecture, that QMA(/c) = 
QMA (2) for all k > 2. 

4.4 Symmetric QMA (A;) 

Define the complexity class SymQMA (A;,a, 6) the same way as QMA(k,a,b), except that now we 
are promised that the k witnesses are all identical (in both the completeness and soundness cases). 
We saw in Section 13.31 that symmetric QMA (A;) protocols are sometimes easier to analyze than 
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non-symmetric ones. However, we will now show that assuming the Weak Additivity Conjecture, 
QMA(A;) and SymQMA(A;) are actually equivalentEl 

The first step is to show they are (unconditionally) equivalent up to a loss in error bounds. 

Lemma 38. QMA {k, a, b) C SymQMA {k, a, b) C QMA (k, 1 - ■^^^, 1 - 2~" 

Proof. For the first containment, have each Merlin in the SymQMA protocol send k witnesses (for 
a total of k"^ witnesses). Then simulate the QMA protocol by using the i witness from the i 
Merlin for all i G [A;]. For the second containment, first observe that 

SymQMA {k, a, b) C SymQMA (A;, 1 - (6 - a) , 1 - 2"") , 

completely analogously to LemmaEl Let 6 = b—a. Then to simulate a SymQMA {k,l — 6,1 — 2~") 
protocol without the symmetry promise we do the following. Let \ipi) be the witness sent by the 
z*'' Merhn. Then 

• With 1/2 probability, Arthur performs a swap test between \ipi) and a random other witness, 
and accepts if and only if the swap test accepts. 

• With 1/2 probability, Arthur runs the SymQMA protocol as if the witnesses were identical. 

In the completeness case, it is clear that Arthur accepts with probability greater than 1 — 2"". 
To show soundness we consider two cases, just like in Theorem [36l Let |$) = \ipi) • • • \^k)- 
First suppose \^) is e-close in trace distance to |(/?i) . Then by Proposition [TJ when he runs the 
SymQMA protocol Arthur will reject with probability at least 6 — e. Next suppose |$) is e-far from 
\ipi) . Then | {(pi\ |$) p < 1 — e^ by Proposition [TOl So by Proposition [U we have 

k 

Y,{i-\{vi\^i)\')>e'. 

2 

Hence when Arthur performs a swap test, he rejects with probability greater than |^. 

Setting e := 35/4, we thus find that the protocol rejects with probability at least g^. D 

Combining Lemma [38] with Theorem 1361 we immediately get the following. 

Theorem 39. The QMA (2) amplification conjecture implies SymQMA (A;) = QMA (A;) = QMA (2) 
for all k>2. 

5 Nonexistence of Perfect Disentanglers 

In this section, we will speak interchangeably about Hilbert spaces and spaces of density operators 
over those Hilbert spaces. 

Definition 40. Let 7i and tC be two finite- dimensional Hilbert spaces. Then given a superoperator 
(^ ■.TL ^ K,® K,, we say $ is an (e, 5)-disentangler if 



^^This does not mean that proving the Weak Additivity Conjecture would supersede the analysis of the non- 
symmetric Ccise in Section O Our result will only show that, assuming the Weak Additivity Conjecture, the witness 
sizes in QMA and SymQMA protocols are polynomially related, which is vacuous in the context of our 3Sat protocol. 
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(i) ^{p) is e-close to a separable state for every p, and 
(ii) for every separable state a, there exists a p such that $ (p) is 5-close to a. 

As pointed out in Section 11.51 if for sufficiently small constants e, 6 there exists an (e, (5)- 
disentangler with log dim "H = poly (log dim /C) — and if, moreover, that disentangler can be imple- 
mented in quantum polynomial time — then QMA (2) = QMA. 

Watrous (personal communication) has proposed the following fundamental conjecture. 

Conjecture 41 (Watrous). For all constants e,5 < 1, any {e, 5) -disentangler requires dimTC = 

nQ{diniK) 

A proof of Conjecture 1411 would be an important piece of formal evidence that QMA (2) ^ QMA, 
and might even lead to a "quantum oracle separation" (as defined by Aaronson and Kuperberg [Ij) 
between the two classes. 

Here we show that, at least in the case e = 6 = 0, no disentangler exists in any finite dimension. 
The counterexamples in Section 11.51 imply that this result would be false if we let either e or (5 be 
nonzero. 

Theorem 42. Let (^ : TL ^ K, (^ K, be any superoperator whose image is the set of separable states. 
Then dim/C > 2 implies diuiTC = oo. 

Proof. For any pure state \a) E fC, by assumption there exists a state pa such that ^{pa) = 
\a) {a\ \a) {a\. By convexity, we can assume pa = \4>a) {(pal is pure. Also, suppose diuiTC is 
finite. Then ^ admits an operator-sum representation ^{p) = X]i=i ^iP^l where X]i=i ^l^i ~ ^■ 
We then have 

k 

$(|0a) (0a|) = ^Ei !</.„) (</.„! eI = \a) {a\ \a) {a\ . 

i=l 

So again by convexity, we find that Ei \(f)a) must be a multiple of \a) \a) for all i and a; that is, 
there exist constants Ca,i such that Ei \(f)a) = Ca,i |a) |a). 

Now let \a) , |/3) be any two pure states in /C with \a) / \(3). Also let IV') = a {(pa) + blcp/s) for 
some nonzero real numbers a, b. Then 

$(|V) (VI) = a'H\<Pa) (0a|) + b^H\M (M) + «&^(l'/'«) (M) + a&^d'/'/?) {<t>a\) 

= a^ \a) {a\ (g) \a) {a\ + b^ \(5) (/3| ® \(3) (/3| + abc\a) (/3| \a) (/3| + abc \(3) {a\ tg) |/3) {a\ , 

where 

k 



C — / ^ C.a,iCj3^i. 



i=l 

We claim that c = 0. To see this, recall that <&(|V') (V'l) is & separable mixed state, and consider 
any decomposition of ^{\ip) ("01) into separable pure states. Since ^{\ip) {ip\) is a mixed state in the 
subspace spanned by \a) \a) and \j3) 1/3), every pure state in the support of ^{\'4') (V|) must have 
the form x \a) \a) + y \(3) \f3). But by the assumption \a) ^ \(3), such a state cannot be separable 
unless X = or y = 0. Hence the only separable pure states in the support of '&(|V') (V'l) are |a) |a) 
and 1/3) 1/3). Therefore abc = 0. But a and b were nonzero, so c = as claimed. 
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This means in particular that $ {\(t>a) (</'/3|) = for all \a) ^ \(5). Hence 

k 



= TT\J2E,\ct>o)mEU 

= TV ($(!,/.„) (</.^|)) 
= 0. 

So for different |a)'s, the states \(j)a) are all orthogonal, and since the number of |a)'s is infinite, 
dim'H must be infinite as well. D 

6 Open Problems 

6.1 The Power of Multiple Merlins 

The power of QMA (2) and related classes is still poorly understood. Can we find a "classical" 
problem (for example, a group-theoretic problem like those of Watrous [29]) that is in QMA (2) but 
not obviously in QMA? Can we find a natural QMA (A;)-complete promise problem? 

We still do not have any upper bound on QMA (2) better than the trivial NEXP, or even good 
evidence for such an upper bound. As mentioned before, an earlier version of this paper showed 
that QMA (2) C PSPACE assuming the "Strong Amplification Conjecture," but Fernando Brandao 
(personal communication) subsequently showed that the same conjecture implies QMA (2) = QMA. 
Can we show under a plausible conjecture that QMA (2) C EXP or (better yet) QMA (2) C PSPACE? 

Regarding our 3Sat protocol, can we reduce the number of provers to two? Can we reduce the 
number of qubits below O {^/n)^ or alternatively, give some sort of evidence against this possibil- 
ity? For example, can we show that VL {\/n) qubits are information-theoretically required for the 
Uniformity Test? Also, can we show that a QMA (A;) protocol for 3Sat with n°(^' qubits would 
have unlikely complexity consequences? 

A long-shot possibility would be to give a quantum algorithm to find the unentangled witnesses 
in the 3Sat protocol, in as much time as it would take were the witnesses entangled. This would 
yield a 2 v^'^-'-time quantum algorithm for 3Sat. 

6.2 Amplification and Other Complexity Issues 

In defining QMA (A;), does it matter if the amplitudes are reals or complex numbers? For BQP 
and QMA, it is not hard to show that this distinction is irrelevant. Interestingly, though, the 
usual equivalence proofs break down for QMA(/c). As evidence that QMA(/c) might actually be 
sensitive to the difference between reals and complex numbers, consider the analysis of our 3Sat 
protocol: in Section 13. 4t the result that we need becomes much simpler to prove when we assume 
all amplitudes are real. 

Can we show directly (i.e., without proving the Weak Additivity Conjecture) that QMA(/c) = 
QMA (2), or that QMA (2) protocols can be amplified? 

Can we prove Conjecture Wi[ that there is no (e, 5)-disentangler with poly (n) qubits and 
£,6 > 0? Can we at least rule out such a disentangler when either e > or 6 > 07 Related 
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to that, can we give a quantum oracle U (as defined by Aaronson and Kuperberg [T]) such that 
QMA 7^ QMA (2)? Can we at least show that Conjecture HTJ would imply the existence of such 
an oracle? 

Define the complexity class QMA (2; h) to be the same as QMA (2), except that now, instead of 
being completely unentangled, the two Merlins are allowed to share h EPR pairs -y= (|00) + |ll))llj 
Can we show — perhaps under some assumption — that QMA (2; h) = QMA (2) for all polynomial h? 

6.3 QMA (A;) With Unentangled Measurements 

Recall that our 3Sat protocol involved three tests: Satisfiability, Symmetry, and Uniformity. Sup- 
pose we are willing to settle for completeness 1 — e rather than 1, and suppose we modify the 
Uniformity Test so that Arthur rejects on not seeing enough collisions. Then can the Symmetry 
Test be omitted? If so, then the resulting protocol would have the extremely interesting prop- 
erty of making no entangled measurements, yet nevertheless depending crucially on the absence of 
entanglement among the witnesses. 

More generally, define BellQMA(A;) to be the subclass of QMA (A;) in which Arthur is restricted 
to making a separate measurement on each witness \(pi), with no entanglement between the mea- 
surements, and no measurement depending on the outcome of any other. (The name arises because 
Arthur is essentially restricted to performing a "Bell experiment.") In an earlier version of this 
paper, we raised the question of whether BellQMA(A;) = QMA: that is, whether a QMA (A:) pro- 
tocol with separate measurements on each witness ever does superpolynomially better than an 
ordinary QMA protocol. Recently, Brandao [9j managed to settle our question, showing that 
BellQMA(/(;) = QMA for all constant kc3 Indeed, Brandao's result applies even to the stronger 
model in which Arthur can first measure \(pi), then choose a measurement for \ip2) depending on 
the outcome of the \ipi) measurement, and so on up to \fk)- (In other words, in which there is 
one-way communication from earlier to later measurement steps.) 

On the other hand, define LOCCQMA(k) to be the subclass of QMA(k) in which Arthur's 
measurements on the k witnesses must be unentangled, but can involve arbitrary local operations 
and classical communication. (In other words, Arthur can perform a partial measurement on \(pi), 
then based on the outcome of that measurement perform a partial measurement on \(p2), then based 
on the outcome of that measurement perform another partial measurement on \(pi), and so on.) 
Then where LOCCQMA (k) sits between QMA and QMA (k) remains an open problem. (Note that 
it is trivial to show amplification for LOCCQMA (k), as for BellQMA (k). This is because, without 
entangling measurements, the entanglement-swapping problem described in Section 11.41 can never 
arise.) 
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